Data Exposure Vulnerability in Paid Membership Subscriptions Plugin for WordPress
CVE-2026-14849
Currently unrated
What is CVE-2026-14849?
The Paid Membership Subscriptions plugin for WordPress lacks adequate security measures, allowing exposed member and payment export files to be accessed by unauthenticated users. This vulnerability arises from the predictable location of the export files in the uploads directory, which could lead to unauthorized access to personally identifiable information (PII) when export artifacts remain on the server. Proper safeguards should be implemented to protect sensitive data from potential breaches.
Affected Version(s)
Paid Membership Subscriptions 0 < 3.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.